Brute Force Time
Estimate the time required to brute-force a password or key given attempt speed.
Inputs
26 lowercase + 26 uppercase + 10 digits = 62; add 32 for symbols = 94
Total Combinations (Keyspace)
2.18 × 10¹⁴
Avg. Time — MD5 (50B/s)
36.39 minutes
Avg. Time — SHA-256 (10B/s)
3.03 hours
Avg. Time — bcrypt (50K/s)
69.19 years
Avg. Time — Argon2 (1K/s)
3,459 years
Step by step
Values used
Password/Key Length = 8 characters; Character Set Size = 62
Total keyspace
combinations = charset_size ^ length
Average crack time
time = (combinations / 2) / hash_rate
Total Combinations (Keyspace)
= 218,340,105,584,896
Avg. Time — MD5 (50B/s)
= 36.39 minutes
Avg. Time — SHA-256 (10B/s)
= 3.03 hours
Avg. Time — bcrypt (50K/s)
= 69.19 years
Avg. Time — Argon2 (1K/s)
= 3,459 years
How it works
The total keyspace an attacker must search is charset_size^length. Assuming attempts are tried in random or sequential order, the average time to find the correct password is the time to search half the keyspace, divided by the attacker's guesses-per-second rate. That rate varies enormously by hashing algorithm: fast, unsalted hashes like MD5 can be attempted at tens of billions per second on modern GPUs, while deliberately slow, memory-hard algorithms like bcrypt and Argon2 are designed to make each guess computationally expensive, dropping the achievable rate to thousands or even hundreds per second.
Formulas
Total keyspace
combinations = charset_size ^ length
- C
- Character set size
- L
- Password length
Average crack time
time = (combinations / 2) / hash_rate
- r
- Attacker's hash attempts per second
Frequently Asked Questions
Why use bcrypt or Argon2 instead of MD5/SHA-256 for password storage?
MD5 and SHA-256 are designed to be fast, which is exactly the wrong property for password hashing — it lets attackers try billions of guesses per second on GPUs. bcrypt and Argon2 are intentionally slow and memory-hard, cutting achievable attack rates by 6-7 orders of magnitude.
Why divide the keyspace by 2 for the average time?
If an attacker searches the keyspace in a fixed order (or randomly without repeats), the correct answer is, on average, found after checking half of all possible combinations — not all of them, and not just one.
How much does adding one more character help?
Each additional character multiplies the keyspace by the charset size, so going from length 8 to 9 with a 62-character set multiplies crack time by 62x — length increases have an exponential, not linear, effect on brute-force resistance.
Does this account for smarter attacks like dictionary or rule-based attacks?
No — this models pure brute-force search across the full keyspace. Real-world attacks often succeed much faster using dictionaries, common password lists, and mutation rules that target likely passwords first rather than searching randomly.